f2d88db941dc4a90b175c0ef3cf42476eb2c0b366a81338a26065c9b29c59281

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
REMOTO-DLL-TECNICO.exe
Size 396KB
Sample260603-pgalysfy7p
SHA256 f2d88db941dc4a90b175c0ef3cf42476eb2c0b366a81338a26065c9b29c59281
MD5 e91ab4bd3623cae279dbe5fb627eea57
SHA1 b720c7acfeb3e98e18babf0454e33f5988f6c72f
SHA512 0d239847c70c8c7d4b07ba67c1eca7df307be9349f6d6c805d62b71ce1de2d67eb4e9f8b723557d8489f03d742093f8527f1354d06bc3ad62e4d80d5179625ac
SSDEEP 6144:k+cyl/IICwlBJuSaPwJ+dU6WcH9WaqThWm0EjW0Vq0TBNk7am8D:FCwlu++dWcH9qT0m0EjW0Vq087x8D
TLSH
T1CB849E1AFBA414F9E1678138CD664945EB727C5A0BA1D7CF23940B962F33AE04E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
892	icacls.exe
3812	icacls.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\REMOTO DLL\log\REMOTO-DLL-TECNICO_rCURRENT.log	REMOTO-DLL-TECNICO.exe
File opened for modification	C:\Windows\SystemTemp\shared_memory-rs\shmem_1C1A23F225051A58	REMOTO-DLL-TECNICO.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
4068	taskkill.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1548	REMOTO-DLL-TECNICO.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2404	REMOTO-DLL-TECNICO.exe
2404	REMOTO-DLL-TECNICO.exe
1548	REMOTO-DLL-TECNICO.exe
1548	REMOTO-DLL-TECNICO.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	REMOTO-DLL-TECNICO.exe
Token: SeDebugPrivilege	4068	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1548	REMOTO-DLL-TECNICO.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1548	REMOTO-DLL-TECNICO.exe
1548	REMOTO-DLL-TECNICO.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 892	1548	REMOTO-DLL-TECNICO.exe	80
PID 1548 wrote to memory of 3812	1548	REMOTO-DLL-TECNICO.exe	81
PID 1548 wrote to memory of 2404	1548	REMOTO-DLL-TECNICO.exe	84
PID 1548 wrote to memory of 1224	1548	REMOTO-DLL-TECNICO.exe	85
PID 1224 wrote to memory of 4068	1224	cmd.exe	89

C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe
"C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\system32\icacls.exe
  "icacls" "C:\ProgramData\REMOTO DLL" /grant *S-1-1-0:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  PID:892
- C:\Windows\system32\icacls.exe
  "icacls" "C:\ProgramData\REMOTO DLL\shared_memory_portable_service" /grant *S-1-1-0:(OI)(CI)F /T
  2⤵
  - Modifies file permissions
  PID:3812
- C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe
  "C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe" --portable-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2404
- - C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe
    "C:\Users\Admin\AppData\Local\Temp\REMOTO-DLL-TECNICO.exe" --run-as-system
    3⤵
    - Drops file in Windows directory
    PID:4952
- C:\Windows\system32\cmd.exe
  "cmd" /c "taskkill /F /IM RuntimeBroker_rustdesk.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM RuntimeBroker_rustdesk.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

shared_memory_portable_service

Path C:\ProgramData\REMOTO DLL\shared_memory_portable_service
Size 23B
SHA256 8c6d56fb90600dad2661b619423952a4c5cdfaf4c3d3d7b02ca0c5a1e856629c
MD5 84511250b7ada918204418e74ee6a738
SHA1 0c3c0108d7ce5b41169bcc0eb136dafc98cd0012
SHA512 1327dbf6e3c91c6cd0b8058c0417d4d9a6fe3c90db3c7e39f828615656c9903a06c3733c3f1f5d3c319effe4b949d727ca5bd2aacd140d8d4770e185873db2dd
MD5 SHA1 SHA512

Submit Download

memory/1548-433-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-108-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-3-0x00000298C53F0000-0x00000298C6095000-memory.dmp

Download

memory/1548-7-0x00000298C53F0000-0x00000298C6095000-memory.dmp

Download

memory/1548-4-0x00000298C53F0000-0x00000298C6095000-memory.dmp

Download

memory/1548-592-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-66-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-223-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-185-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-143-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-8-0x00000298C53C0000-0x00000298C53C1000-memory.dmp

Download

memory/1548-551-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-511-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-263-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-304-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-345-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-387-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/1548-2-0x00000298C52B0000-0x00000298C52B1000-memory.dmp

Download

memory/1548-475-0x00000298C0140000-0x00000298C1DEF000-memory.dmp

Download

memory/2404-12-0x0000025784A10000-0x00000257866BF000-memory.dmp

Download

memory/4952-73-0x0000013A8ED30000-0x0000013A909DF000-memory.dmp

Download

memory/4952-148-0x0000013A8ED30000-0x0000013A909DF000-memory.dmp

Download

memory/4952-597-0x0000013A8ED30000-0x0000013A909DF000-memory.dmp

Download